Daily · Article 02 · 5 min read
- Security
GMO confirms publication-site domain suspension and updates device-reuse guidance
Notices 13/14 dated October 28 · rechecked October 29 JST
Summary
GMO Internet reported a suspended publication-site domain on October 28 and 113 submissions to its information channel. Notice 14 says no infection traces were found in examined devices and asks customers to scan and back up before reuse.
What changes for a customer when the address of a site publishing stolen information stops working? Japanese infrastructure provider GMO Internet issued notices 13 and 14 on October 28 about Onamae.com Desktop Cloud, covering the blocked publication route and device analysis. Its new device-reuse guidance leaves account protection and previously removed information as separate checks.
Key facts
In notice 13, issued as of 11:00 JST on October 28, GMO said it confirmed suspension of the publication-site domain around 04:00 that day after work with relevant providers. Notice 13
Notice 14, as of 18:20, says analysis of devices entrusted to the company had not found traces of malware infection or a ransomware attack. It requests a security scan and backup before reuse. This observation must retain its examined-device scope. Notice 14
Affected customers can use another safe device and the financial provider’s official channel to confirm existing connections ended and review orders, completed trades and balances. If a device’s power or network state makes the scan sequence unclear, explain that state to GMO support before proceeding. Earlier account-protection guidance remains in notice 3 and the group guidance.
1. What does stopping an address achieve?
A domain is a human-readable website address. Blocking access through it can reduce one route by which people reach the published material. Think of removing a sign pointing to delivered mail; that does not retrieve mail already delivered. Notice 13 establishes the domain suspension, while recovery or deletion of information already removed requires separate evidence.
| Place to check | What this announcement establishes | What remains separate |
|---|---|---|
| Publication-site address | Company confirmed suspension around 04:00 on 28 October | Republication through other addresses |
| Previously removed information | A risk to manage separately from address blocking | Recovery or deletion of copies and individual information |
| Trading accounts and devices | Separate services and computers require their own checks | Connections, trades and device results |
- Place to check
Publication-site address
- What this announcement establishes
- Company confirmed suspension around 04:00 on 28 October
- What remains separate
- Republication through other addresses
- Place to check
Previously removed information
- What this announcement establishes
- A risk to manage separately from address blocking
- What remains separate
- Recovery or deletion of copies and individual information
- Place to check
Trading accounts and devices
- What this announcement establishes
- Separate services and computers require their own checks
- What remains separate
- Connections, trades and device results
The cat asks Q&A
The researcherWhich link should someone use to share news of the incident?
Pocket NotebookLink the official notice and support guidance. You can explain the response without reproducing a leak-site address or a victim’s information. Notice 13 also asks people to provide information through appropriate channels without directly linking dangerous sites.
2. The scope of the new device-reuse guidance
The absence of detected traces in notice 14 concerns devices entrusted to GMO for analysis. It does not assess every customer PC. The company thanked customers who had switched devices off and asked them to scan and back up before using them again.
This diagram organizes the request, rather than prescribing how to examine an off or possibly infected computer. When that sequence is unclear, contact official support from another safe device and describe its current state.
%% Checks before device reuse · interpretation of GMO notice 14
flowchart TD
A["Check power<br/>and network state"] --> B["Establish scan and backup steps<br/>If unclear, ask support from another safe device"]
B --> C["Follow a suitable sequence<br/>for security scan and backup"]
C --> D["Review symptoms and scan results<br/>before deciding on reuse"]The cat asks Q&A
- The researcher
What evidence can I use if my PC was not in the examined sample?
Pocket NotebookUse its own results and symptoms together with official support’s procedure. The finding in devices supplied to the company cannot simply be transferred to yours. Protect accounts from another safe device instead of testing a suspect computer by entering a new password.
3. What proves account protection completed?
The service keeps trading software running on a remote server. The financial provider’s account and a home PC exist separately from that server. Blocking a publication-site address therefore does not end connections at the trading provider. Notice 3 described possible acquisition and misuse of login information and asked customers to end all sessions, because existing connections can remain after a password change.
A session is a connection kept active after login. Changing a password changes the key for the next entry; ending existing sessions removes connections already admitted. The mechanism differs by provider, so distinguish performing an action from obtaining evidence that it took effect.
| Action | Possible completion evidence | Record to examine next |
|---|---|---|
| Request all existing connections ended | Provider’s connection list or official confirmation | Whether unfamiliar connections remain |
| Change password and add authentication | State shown in official account settings | Whether supported logins use it |
| Review transactions | Orders, completed trades and balances | Report unfamiliar trades to the provider |
- Action
Request all existing connections ended
- Possible completion evidence
- Provider’s connection list or official confirmation
- Record to examine next
- Whether unfamiliar connections remain
- Action
Change password and add authentication
- Possible completion evidence
- State shown in official account settings
- Record to examine next
- Whether supported logins use it
- Action
Review transactions
- Possible completion evidence
- Orders, completed trades and balances
- Record to examine next
- Report unfamiliar trades to the provider
The cat asks Q&A
- The researcher
Do I still need financial-provider records after a clean PC scan?
Pocket NotebookA PC scan cannot show a separate provider’s connections or transactions. Possible misuse of information on the remote server is a different question from infection of your own PC. The earlier explainer covers the account-risk structure and what is known about the entry path.
4. What does the count of 113 submissions measure?
Notice 14 says the information channel opened at 12:00 JST on October 28 and received 113 submissions in six hours, as of 18:00. The company was checking and examining them. The 20 figure at the same time counts cumulative warning contacts concerning X posts. These are different activities, not victim counts or identified perpetrators.
| Number and time | What was counted | What it cannot establish |
|---|---|---|
| 113 · 18:00 on 28 October | Information submitted in the first six hours | Truth, duplication or investigative success |
| Cumulative 20 · same time | Warning contacts about relevant X posts | Number of victims or leaked records |
- Number and time
113 · 18:00 on 28 October
- What was counted
- Information submitted in the first six hours
- What it cannot establish
- Truth, duplication or investigative success
- Number and time
Cumulative 20 · same time
- What was counted
- Warning contacts about relevant X posts
- What it cannot establish
- Number of victims or leaked records
The cat asks Q&A
- The researcher
Which announcement would show investigative progress?
Pocket NotebookLook for an official statement specifying verified information or identification and arrest. A submission count cannot establish those outcomes in advance. The channel is not a request to independently identify or contact suspected perpetrators.
To close
Address blocking and individual evidence
The new developments concern a publication route, the current device-analysis scope and precautions before reuse. Affected customers still need evidence about their own devices and the financial provider’s connections and transactions alongside that containment result.
Sources
- Notice 13internet.gmo
- Notice 14internet.gmo
- notice 3internet.gmo
- group guidancegroup.gmo